#139671 by clarksn Fri Dec 14, 2012 6:43 am
Hi,

Just to get some of the keywords out in the "Googlesphere" is a December 2012 example of the hotel rooms booking overpayment scam to try and protect others... [our contact details have been redacted]. This one targetted at the UK.

Other characteristics that give this scam away early in the process as "suspicious":
- Use of bad grammar, poor English and American English spellings in an email allegedly from Scotland suggests non-native speaker
- use of gmail and yahoo email addresses that seemed very generic
- change of email address used between consecutive emails
- use of an email address for us which was not our primary contact address

cut and paste follows:


From: Kelvin Coleman [mailto:[email protected]]
Sent: 14 December 2012 05:16
To: [redacted]
Subject: URGENT CONFIRM

hello ,

Thanks for your email and for the total cost for the reservation

which you have provided.i have concluded all payment arrangement.

As soon as you receive my card detail for payment,i want you to

take the following steps:

A) Make an total charge of £4749.60 + bank charges from my card

Detail.

B) Deduct the total deposit of £1749.60 needed to secure book-

C) send the balance of £3000 ia bank transfer to the prepaid

travel agent who will handle our traveling logistics which i will

advice.


The travel agent is in charge of the procurement of flight

tickets of guests to and fro.

However, because agent do not have credit card facility and for

security reason,i have decided that ONLY YOU will have to handle

the credit card information.

PLEASE CONFIRM IF THIS ARRANGEMENT IS OK.

Awaiting your swift response,

Kelvin

--- On Thu, 13/12/12, [redacted]> wrote:

From: [redacted]
Subject: RE: Rooms Booking cost
To: "'Kelvin Coleman'" <[email protected]>
Date: Thursday, 13 December, 2012, 17:12

[we reconfirmed the total pricing]



From: Kelvin Coleman [mailto:[email protected]]
Sent: 13 December 2012 16:26
To: [redacted]
Subject: RE: Rooms Booking cost

Hello ,

Thanks for email and confirming that you have availability for reservation.I want to have the grand total cost for reservation -
I also want you to confirm if its possible to make advance payment via credit card to properly secure the reservation ...

Awaiting your swift response,

Kelvin

--- On Thu, 13/12/12, [redacted]> wrote:

From: [redacted]
Subject: RE: Rooms Booking
To: "'Kelvin Coleman'" <[email protected]>
Date: Thursday, 13 December, 2012, 8:54
Thank you for your enquiry,

[we provided pricing and availability]

-----Original Message-----
From: Kelvin Coleman [mailto:[email protected]]
Sent: 13 December 2012 05:05
To: undisclosed-recipients:
Subject: Rooms Booking

Hello,

I want to inquire about the rooms reservation for 6 people from

21st to 27th of April, 2013.

The information that I request are as follows:
Arrival date: 21st April
Departure date: 27th April
number of guests: 6
number of rooms :3
Get back to me if you have opening for reservation during my

stated date.

Warm Regards,

Kelvin Coleman
19 St. Vincent Street
Glasgow
G2 5NW
Scotland
+447035928032
Advertisement

#167205 by Bryon Williams Wed May 29, 2013 9:56 am
Kelvin Coleman
[email protected]
447012916587

Subject: booking

Hello,

I want to inquire about the rooms reservation for 6 people from 21st
to 27th of July, 2013.

The information that I request are as follows:
Arrival date: 21st July
Departure date: 27th July
number of guests: 6
number of rooms :3
Get back to me if you have opening for reservation during my stated date.

Warm Regards,

Kelvin Coleman
19 St. Vincent Street
Glasgow
G2 5NW
Scotland
+447012916587

Please contact Mike Wilson if you have a question or information about this post.

mike-wilson @ scawarners.com

Please do not tell the scammer he is posted here.


Please remember the fallen. https://www.odmp.org/
#167616 by Bryon Williams Sun Jun 02, 2013 10:19 am
[email protected]

IP Address: 41.206.15.44
Organization: Vgc Communication
City: Lagos
Country of Origin: Nigeria

Please contact Mike Wilson if you have a question or information about this post.

mike-wilson @ scawarners.com

Please do not tell the scammer he is posted here.


Please remember the fallen. https://www.odmp.org/
#167843 by Bryon Williams Tue Jun 04, 2013 10:32 am
Kelvin Coleman

[email protected]

IP Address: 41.206.15.44
Organization: Vgc Communication
City: n/a
Country of Origin: Nigeria

Hello ,

Thanks for email and confirming that you have availability for reservation.I want to have the grand total cost for reservation -
I also want you to confirm if its possible to make advance payment via credit card to properly secure the reservation ...

Awaiting your swift response,

Kelvin


In this scam the scammer will give you stolen credit card information. He will later find a reason for you to send an over payment to a third party via Western Union or Money Gram. He is only wanting to steal your money. He does not want a vacation or accommodations.

Soon the real account holder will realize that their account was stolen and report it to the bank. You will have to repay all the money back to the bank.

Please contact Mike Wilson if you have a question or information about this post.

mike-wilson @ scawarners.com

Please do not tell the scammer he is posted here.


Please remember the fallen. https://www.odmp.org/
#168114 by Bryon Williams Fri Jun 07, 2013 9:35 am
[email protected]
Kelvin Coleman
41.206.15.25
Received: by 10.114.18.161 with SMTP id x1csp91036ldd;
Fri, 7 Jun 2013 01:09:41 -0700 (PDT)
X-Received: by 10.68.204.196 with SMTP id la4mr42267276pbc.190.1370592580350;
Fri, 07 Jun 2013 01:09:40 -0700 (PDT)
Return-Path: <[email protected]>
Received: from nm10-vm1.bullet.mail.ird.yahoo.com (nm10-vm1.bullet.mail.ird.yahoo.com. [77.238.189.93])
by mx.google.com with SMTP id ln2si976707pab.54.2013.06.07.01.09.38
for <[email protected]>;
Fri, 07 Jun 2013 01:09:40 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of [email protected] designates 77.238.189.93 as permitted sender) client-ip=77.238.189.93;
Authentication-Results: mx.google.com;
spf=pass (google.com: best guess record for domain of [email protected] designates 77.238.189.93 as permitted sender) [email protected];
dkim=pass [email protected]
Received: from [77.238.189.57] by nm10.bullet.mail.ird.yahoo.com with NNFMP; 07 Jun 2013 08:09:37 -0000
Received: from [212.82.108.242] by tm10.bullet.mail.ird.yahoo.com with NNFMP; 07 Jun 2013 08:09:36 -0000
Received: from [127.0.0.1] by omp1007.mail.ird.yahoo.com with NNFMP; 07 Jun 2013 08:09:36 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 39293 invoked by uid 60001); 7 Jun 2013 08:09:36 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1370592576; bh=xQPpIdJg+1KNJSUPmYRGYS1WdsljxN7SosMg3UCghl4=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=HHGt3cTd2PLX+gnnvzUMwcihkZIrmMhJyFgw+xvCvrchx67wOLjRrktknEZYTDxSbnYkGfQS34RBrlvh8V6w7ZdFvAF+nK6VkqjJxM2/HHLoPHOc7KlfHiyWMWYDiS3rLbWG7+QdXkTvHf1bEJ7gG2G5NwNzX84RtASa04+cZsk=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type;
Received: from [41.206.15.25] by web171406.mail.ir2.yahoo.com via HTTP; Fri, 07 Jun 2013 09:09:36 BST
X-Mailer: YahooMailClassic/15.1.8 YahooMailWebService/0.8.145.547
Message-ID: <[email protected]>
Date: Fri, 7 Jun 2013 09:09:36 +0100 (BST)
From: Kelvin Coleman <[email protected]>
Subject: URGENT CONFIRM


hello ,

Thanks for your email and for the total cost for the reservation which you have provided.i have concluded all payment arrangement.

As soon as you receive my card detail for payment,I will like you to take the following steps:

A) Make an total charge of £7657.00 + bank charges from my card Detail.

B) Deduct the total deposit of £7657.00 needed to secure book-

C) send the balance of $7000 via bank transfer to the prepaid American travel agent who will handle our traveling logistics which i will advice.


The travel agent is in charge of the procurement of flight tickets of guests to and fro.

However, because agent do not have credit card facility and for security reason,i have decided that ONLY YOU will have to handle the credit card information.

PLEASE CONFIRM IF THIS ARRANGEMENT IS OK.

Awaiting your swift response,

Kelvin

Please contact Mike Wilson if you have a question or information about this post.

mike-wilson @ scawarners.com

Please do not tell the scammer he is posted here.


Please remember the fallen. https://www.odmp.org/
#168592 by Bryon Williams Tue Jun 11, 2013 5:06 pm
From: Kelvin Coleman < [email protected] >
Subject: ACCOUNT DETAIL......PROCEED AND TRANSFER

Hello Xxxxxxx,

Sorry for the delay in response.Below is the agent's account details.

Account Name : Anthony Suite
Address : Maryland USA
Routing Number : 02200xxxx
Account Number : 986204xxxx
Bank Name : M&T Bank
Bank Address : 11807 Livingston rd, Fort Washington MD 20744, USA

Proceed and make the transfer of £2,500.00 into this account and get back to me with a scanned copy of the transfer slip as proof of transfer made into that account.

Awaiting your response,

Kelvin

Please contact Mike Wilson if you have a question or information about this post.

mike-wilson @ scawarners.com

Please do not tell the scammer he is posted here.


Please remember the fallen. https://www.odmp.org/

Who is online

Users browsing this forum: No registered users and 2 guests